release: publish SHA256SUMS alongside binaries

Not everyone has gh installed; a coreutils sha256sum -c covers the
common "did my download get truncated/corrupted" case without any
tooling. The SHA256SUMS file lands in the same out_dir as the binaries
and is therefore also covered by the attestation, so its integrity can
be verified once and then used offline.

Fix release script quoting (NixOS#32)

Since it isn't quoted, the default value "" for testing_hydra_eval_id
gets swallowed.

Handle no args in assemble_installer.py as well just to be less lazy.